What happened
Published 2026-08-20 (CVSS 8.8, High), this vulnerability allows any authenticated LangBot user — not just administrators — to register a new STDIO MCP server pointing at an arbitrary local command, which LangBot will then execute as part of its normal MCP tool-invocation flow.
Why it matters
This is a direct agent-to-tool trust-boundary failure: MCP server registration is supposed to be a privileged administrative action, but LangBot's missing authorization check lets any user turn the LLM-agent host into an arbitrary command-execution primitive, a pattern increasingly seen across MCP-integrating platforms.
Attack vector
Any authenticated user can add or change a STDIO MCP server configuration without an adequate authorization boundary; StdioServerParameters in src/langbot/pkg/provider/tools/loaders/mcp.py accepts the configured command and arguments without restriction, allowing a low-privileged user to register an arbitrary local command as an MCP tool provider, which is then executed by the LangBot process when the LLM invokes that tool.
Affected systems
LangBot (global IM bot platform for LLMs) version 4.10.7 and earlier
Mitigation
Apply the fix in GHSA-3pvh-63gf-j9mw; restrict MCP server configuration changes to admin-only roles; audit existing STDIO MCP server configs for unauthorized entries.